Exclusiva: Grok Bot de SpaceXAI inserta un ID derivado de la cuenta en las solicitudes del navegador
El valor de 16 caracteres se deriva de la cuenta Cursor autenticada y llega a sitios web externos a través del encabezado User-Agent de Chrome.
By RuntimeWire Staff · Published
RUNTIMEWIRE INVESTIGATION — Exclusive
Original reporting by RuntimeWire, based on reverse engineering, data analysis, testing.
Por qué importa
Grok Bot proporciona a los sitios web una clave de reconocimiento persistente a través de metadatos HTTP rutinarios, con lo que puede aparecer en los registros del servidor y de analítica sin controles al estilo de cookies.
Reporting record
Finding
Grok Bot’s cloud Chrome browser sent an unrelated website a 16-character pseudonymous identifier that the shipped client deterministically derives from the authenticated Cursor account’s JWT subject and appends to the User-Agent header.
How we verified
Methods: reverse engineering, data analysis, testing.
Inspection of Grok Bot for Windows 0.16.0 showed that the client hashes the authenticated Cursor account’s JWT sub claim with SHA-256, retains the first 16 hexadecimal characters and writes the result to /tmp/sand-ua-user. Shipped browser configuration describes the resulting suffix as GrokAgent/1.0 (u:<owner>) and applies it to Chrome launches and new tabs. A signed-in live test using Grok Bot’s graphical browser returned the same format from https://httpbingo.org/user-agent. A ChatGPT for Windows control returned a standard Chrome user agent without a product or account suffix. The full Grok Bot identifier has been redacted.
RuntimeWire verified the Windows package metadata, extracted app.asar and inspected the shipped source maps. We traced the browser identifier from the authenticated JWT subject through its SHA-256 derivation, 16-character truncation, local stamp file and Chrome user-agent configuration. We then instructed a signed-in Grok Bot to open Httpbingo’s user-agent endpoint through graphical Chrome, explicitly prohibiting terminal commands and other HTTP clients. The external server returned GrokAgent/1.0 and a 16-character u: value matching the implementation. RuntimeWire repeated the endpoint test through ChatGPT for Windows as a control and compared the returned headers. Only one Grok Bot account was tested.
Tested versions:
- Grok Bot for Windows 0.16.0
- managed Chrome 151.0.0.0
- ChatGPT for Windows control — app version not recorded
Reproduction
RuntimeWire independently reproduced the core finding.
Sign in to Grok Bot for Windows 0.16.0.
Instruct the agent to use its graphical Chrome browser to open https://httpbingo.org/user-agent.
Prohibit terminal commands, curl, Python and other HTTP clients.
Observe the returned User-Agent header. Confirm the suffix follows GrokAgent/1.0 (u:<16 hexadecimal characters>).
Refresh or open the endpoint in another tab to check whether the value remains stable. Redact the complete identifier before publishing screenshots.
File hashes
sha256:955fb24e72ec85729cac2f921758a93a85089a0fc659e712125d6650b364d20e app(2).asar
Company response
RuntimeWire requested comment; the company had not responded by publication time.
El Grok Bot de SpaceXAI identifica la cuenta detrás de su navegador en la nube mediante una etiqueta persistente incrustada en el encabezado user-agent de Chrome, encontró RuntimeWire.
En una prueba en vivo el 12 de agosto de 2026, un Grok Bot para Windows con sesión iniciada abrió el endpoint de user-agent de Httpbingo a través de su navegador gráfico en la nube. El servidor externo recibió este encabezado, con la etiqueta de la cuenta parcialmente redactada por RuntimeWire:…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.